FluentCommunity Extreme Add-On WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.3.3

Findings

2

Worst severity

high

Content hash

9af908e6df5acc925cea4f00… Copy

Findings

• high Admin AJAX registered for nopriv and gated by is_admin() instead of capability

  missing_capability

  wp_fce_handle_admin_ajax_callback is hooked to both wp_ajax_ and wp_ajax_nopriv_. The handler verifies nonce security_wp-fce then accepts the request if is_admin() is true. is_admin() is true for every admin-ajax.php request, so it is not an authorization check. The same nonce is wp_localize_script'd from admin_enqueue_scripts on all admin pages, including those Subscribers can open (profile). With that nonce, $_POST[func] dispatches to private methods such as delete_product and update_access_rule, mutating products and access overrides.

  admin/class-wp-fce-admin-ajax.php:7-39

  Recommendation

  Remove the nopriv hook. Replace is_admin() with current_user_can( appropriate manage cap ). Avoid dynamic method dispatch from user input; map an allowlist of actions.

• low Admin AJAX dynamic method dispatch from POST func

  unsafe_input

  After the weak gate, any private method name present on Wp_Fce_Admin_Ajax_Handler can be invoked via $_POST[func]. Combined with the missing capability check this expands the blast radius; even after adding a capability check, dispatch should be allowlisted.

  admin/class-wp-fce-admin-ajax.php:28-39

  Recommendation

  Map POST action keys to explicit private methods; never call method_exists on raw user strings.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.